Management roles in a role-based framework may be upgraded by updating existing management roles, updating derived roles, and deprecating or reducing existing and derived roles in the role-based framework. The existing management roles may include a set of existing role entries for defining an action using parameters, scripts, application program interface calls, and a special permission for enabling performance of tasks defined by the management roles. The derived roles may include custom management roles derived from the existing management roles in the role-based framework.